Analysis
-
max time kernel
71s -
max time network
48s -
platform
windows7_x64 -
resource
win7-20220414-en -
submitted
05-05-2022 17:05
General
-
Target
pandora/54664bedb8b1e8e5a05a60490739080c757a234a71cbee0917f1bdfde3c95b97.exe
-
Size
146KB
-
MD5
ee9e9d6b90c5df29a52464e977b566ad
-
SHA1
d8f9b34d0e14f303373a86f52716ca0351977b1a
-
SHA256
54664bedb8b1e8e5a05a60490739080c757a234a71cbee0917f1bdfde3c95b97
-
SHA512
252884ad25e49e9a167b0172602badb605dcdf4aea20743900ceb4adda5b638307fefebda48bea9b035d63c8f680a1bfb68477e2bc52ecb7f5e65088962c6773
Score
10/10
Malware Config
Extracted
Path
C:\Program Files\7-Zip\Restore-My-Files.txt
Family
lockbit
Ransom Note
All your important files are encrypted!
Any attempts to restore your files with the thrid-party software will be fatal for your files!
RESTORE YOU DATA POSIBLE ONLY BUYING private key from us.
There is only one way to get your files back:
1) Through a standard browser(FireFox, Chrome, Edge, Opera)
| 1. Open link http://lockbit-decryptor.top/?8B28321ABD4E73FF947FFDB0830A9BBD
| 2. Follow the instructions on this page
2) Through a Tor Browser - recommended
| 1. Download Tor browser - https://www.torproject.org/ and install it.
| 2. Open link in TOR browser - http://lockbitks2tvnmwk.onion/?8B28321ABD4E73FF947FFDB0830A9BBD
This link only works in Tor Browser!
| 3. Follow the instructions on this page
### Attention! ###
# lockbit-decryptor.top may be blocked. We recommend using a Tor browser to access the site
# Do not rename encrypted files.
# Do not try to decrypt using third party software, it may cause permanent data loss.
# Decryption of your files with the help of third parties may cause increased price(they add their fee to our).
# Tor Browser may be blocked in your country or corporate network. Use https://bridges.torproject.org or use Tor Browser over VPN.
# Tor Browser user manual https://tb-manual.torproject.org/about
URLs
http://lockbit-decryptor.top/?8B28321ABD4E73FF947FFDB0830A9BBD
http://lockbitks2tvnmwk.onion/?8B28321ABD4E73FF947FFDB0830A9BBD
Extracted
Path
C:\Users\Admin\Desktop\LockBit-note.hta
Ransom Note
Lock BIT
Any attempts to restore your files with the thrid-party software will be fatal for your files!
Restore you data posible only buying private key from us.
There is only one way to get your files back:
Through a standard browser Open link - http://lockbit-decryptor.top/?8B28321ABD4E73FF947FFDB0830A9BBD Follow the instructions on this page
Through a recommended Download Tor Browser - https://www.torproject.org/ and install it. Open link in Tor Browser - http://lockbitks2tvnmwk.onion/?8B28321ABD4E73FF947FFDB0830A9BBD This link only works in Tor Browser! Follow the instructions on this page Lockbit-decryptor.com may be blocked. We recommend using a Tor browser to access the site Do not rename encrypted files. Do not try to decrypt using third party software, it may cause permanent data loss. Decryption of your files with the help of third parties may cause increased price (they add their fee to our). Tor Browser may be blocked in your country or corporate network. Use https://bridges.torproject.org or use Tor Browser over VPN. Tor Browser user manual https://tb-manual.torproject.org/about
URLs
http://lockbit-decryptor.top/?8B28321ABD4E73FF947FFDB0830A9BBD
http://lockbitks2tvnmwk.onion/?8B28321ABD4E73FF947FFDB0830A9BBD
Signatures
-
Lockbit
Ransomware family with multiple variants released since late 2019.
-
Deletes shadow copies 2 TTPs
Ransomware often targets backup files to inhibit system recovery.
-
Modifies boot configuration data using bcdedit 1 TTPs 2 IoCs
-
Deletes backup catalog 3 TTPs 1 IoCs
Uses wbadmin.exe to inhibit system recovery.
-
Modifies extensions of user files 4 IoCs
Ransomware generally changes the extension on encrypted files.
-
Deletes itself 1 IoCs
-
Adds Run key to start application 2 TTPs 4 IoCs
-
Sets desktop wallpaper using registry 2 TTPs 1 IoCs
-
Suspicious use of NtSetInformationThreadHideFromDebugger 64 IoCs
-
Drops file in Program Files directory 64 IoCs
-
Enumerates physical storage devices 1 TTPs
Attempts to interact with connected storage/optical drive(s). Likely ransomware behaviour.
-
Interacts with shadow copies 2 TTPs 1 IoCs
Shadow copies are often targeted by ransomware to inhibit system recovery.
-
Modifies Control Panel 2 IoCs
-
Modifies Internet Explorer settings 1 TTPs 1 IoCs
-
Runs ping.exe 1 TTPs 1 IoCs
-
Suspicious behavior: EnumeratesProcesses 1 IoCs
-
Suspicious use of AdjustPrivilegeToken 48 IoCs
-
Suspicious use of WriteProcessMemory 35 IoCs
Processes
-
C:\Users\Admin\AppData\Local\Temp\pandora\54664bedb8b1e8e5a05a60490739080c757a234a71cbee0917f1bdfde3c95b97.exe"C:\Users\Admin\AppData\Local\Temp\pandora\54664bedb8b1e8e5a05a60490739080c757a234a71cbee0917f1bdfde3c95b97.exe"1⤵
- Modifies extensions of user files
- Adds Run key to start application
- Sets desktop wallpaper using registry
- Suspicious use of NtSetInformationThreadHideFromDebugger
- Drops file in Program Files directory
- Modifies Control Panel
- Suspicious behavior: EnumeratesProcesses
- Suspicious use of AdjustPrivilegeToken
- Suspicious use of WriteProcessMemory
-
C:\Windows\System32\cmd.exe"C:\Windows\System32\cmd.exe" /c vssadmin delete shadows /all /quiet & wmic shadowcopy delete & bcdedit /set {default} bootstatuspolicy ignoreallfailures & bcdedit /set {default} recoveryenabled no & wbadmin delete catalog -quiet2⤵
- Suspicious use of WriteProcessMemory
-
C:\Windows\system32\vssadmin.exevssadmin delete shadows /all /quiet3⤵
- Interacts with shadow copies
-
C:\Windows\System32\Wbem\WMIC.exewmic shadowcopy delete3⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} bootstatuspolicy ignoreallfailures3⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\bcdedit.exebcdedit /set {default} recoveryenabled no3⤵
- Modifies boot configuration data using bcdedit
-
C:\Windows\system32\wbadmin.exewbadmin delete catalog -quiet3⤵
- Deletes backup catalog
-
C:\Windows\SysWOW64\mshta.exe"C:\Windows\SysWOW64\mshta.exe" "C:\Users\Admin\Desktop\LockBit-note.hta"2⤵
- Modifies Internet Explorer settings
-
C:\Windows\SysWOW64\cmd.exe"C:\Windows\System32\cmd.exe" /C ping 127.0.0.7 -n 3 > Nul & fsutil file setZeroData offset=0 length=524288 "C:\Users\Admin\AppData\Local\Temp\pandora\54664bedb8b1e8e5a05a60490739080c757a234a71cbee0917f1bdfde3c95b97.exe" & Del /f /q "C:\Users\Admin\AppData\Local\Temp\pandora\54664bedb8b1e8e5a05a60490739080c757a234a71cbee0917f1bdfde3c95b97.exe"2⤵
- Deletes itself
- Suspicious use of WriteProcessMemory
-
C:\Windows\SysWOW64\PING.EXEping 127.0.0.7 -n 33⤵
- Runs ping.exe
-
C:\Windows\SysWOW64\fsutil.exefsutil file setZeroData offset=0 length=524288 "C:\Users\Admin\AppData\Local\Temp\pandora\54664bedb8b1e8e5a05a60490739080c757a234a71cbee0917f1bdfde3c95b97.exe"3⤵
-
C:\Windows\system32\vssvc.exeC:\Windows\system32\vssvc.exe1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\system32\wbengine.exe"C:\Windows\system32\wbengine.exe"1⤵
- Suspicious use of AdjustPrivilegeToken
-
C:\Windows\System32\vdsldr.exeC:\Windows\System32\vdsldr.exe -Embedding1⤵
-
C:\Windows\System32\vds.exeC:\Windows\System32\vds.exe1⤵
Network
MITRE ATT&CK Matrix ATT&CK v6
Replay Monitor
Loading Replay Monitor...
Downloads
-
C:\Users\Admin\Desktop\LockBit-note.htaFilesize
17KB
MD50be8f356dde673de005bdfe3f5c726f8
SHA114ba2d06f0cfa19e946634b57b2ad80e58dbd744
SHA256ed0a2f7f193e2972e6c99002cd1563f6a1b02836e3ad94af71c6314807311ab2
SHA512dca21ae29685d0efc8f549c427147f93dbc326c48f0a93897e11f05d1556072d1961a7d69f3ad5adb894064526f9c60d4dcc4ad7c2edadabf0478945dec3e793
-
\??\PIPE\srvsvcMD5
d41d8cd98f00b204e9800998ecf8427e
SHA1da39a3ee5e6b4b0d3255bfef95601890afd80709
SHA256e3b0c44298fc1c149afbf4c8996fb92427ae41e4649b934ca495991b7852b855
SHA512cf83e1357eefb8bdf1542850d66d8007d620e4050b5715dc83f4a921d36ce9ce47d0d13c5d85f2b0ff8318d2877eec2f63b931bd47417a81a538327af927da3e
-
memory/1156-54-0x0000000075271000-0x0000000075273000-memory.dmpFilesize
8KB
-
memory/1408-57-0x0000000000000000-mapping.dmp
-
memory/1624-58-0x0000000000000000-mapping.dmp
-
memory/1664-59-0x0000000000000000-mapping.dmp
-
memory/1896-69-0x0000000000000000-mapping.dmp
-
memory/1968-60-0x0000000000000000-mapping.dmp
-
memory/1968-61-0x000007FEFB9F1000-0x000007FEFB9F3000-memory.dmpFilesize
8KB
-
memory/1992-56-0x0000000000000000-mapping.dmp
-
memory/2012-55-0x0000000000000000-mapping.dmp
-
memory/2908-63-0x0000000000000000-mapping.dmp
-
memory/2924-64-0x0000000000000000-mapping.dmp
-
memory/2960-65-0x0000000000000000-mapping.dmp